KCNA Kubernetes Fundamentals Practice Question
Which THREE of the following are true about Kubernetes labels and selectors?
⚠ Common exam trap
CNCF often tests the misconception that labels are immutable like certain other Kubernetes fields, but labels are explicitly designed to be mutable for dynamic resource management.
Answer choices
Why each option matters
Answer the question above first, then reveal the full breakdown to understand why each option is right or wrong.
Correct answer & explanation
✓
Set-based selectors support operators like 'In' and 'NotIn'
Option B is correct because set-based selectors support operators such as In, NotIn, Exists, and DoesNotExist, allowing matching against a set of values rather than a single equality. Option C is correct because a Service uses its selector to match pod labels and route traffic only to the pods whose labels satisfy that selector. Option E is correct because labels are key/value pairs attached to objects specifically so users can organize and select subsets of objects, for example with kubectl get pods -l app=web. Option A is not correct because labels are ordinary metadata and are not encrypted at rest by default; encryption at rest applies to etcd data only if configured. Option D is not correct because labels are mutable and can be added, updated, or removed after object creation.
Answer analysis
Option-by-option breakdown
For each option: why learners choose it and why it is or isn't the right answer here.
- ✗
Labels are encrypted at rest by default
Why it's wrong here
Labels are plain-text key/value metadata stored unencrypted in etcd, so they cannot be encrypted at rest by default. Encryption applies to Secrets via a configured EncryptionConfiguration. The option tempts administrators seeking data-protection guarantees, but labels exist purely for grouping and selection, never for confidentiality.
- ✓
Set-based selectors support operators like 'In' and 'NotIn'
Why this is correct
Set-based requirements use In, NotIn, Exists and DoesNotExist, matching a label against a list of values rather than exact equality. Equality-based selectors only compare a single key to a single value, so this statement is true.
- ✓
Selectors can be used by Services to identify which pods to route traffic to
Why this is correct
Services rely on label selectors to define their endpoint set, continuously matching pods whose labels satisfy the selector and routing traffic only to those. This satisfies the stem's requirement that selectors drive traffic routing, since a Service without matching pods receives no endpoints.
- ✗
Labels are immutable after creation
Why it's wrong here
Labels are mutable: you can add, overwrite or remove them at any time with kubectl label, which is how workloads get reclassified. Immutability applies to fields such as a Pod's spec containers, not metadata labels. The option tempts those confusing labels with immutable identity fields, but selectors depend on labels being freely changeable.
- ✓
Labels can be used to organize and select subsets of objects
Why this is correct
Labels attach arbitrary key-value metadata to objects, and selectors query that metadata to filter resources by any dimension you define, such as environment, tier or release track. This satisfies the stem's requirement that labels organise and select subsets of objects, enabling grouping independent of object names or namespaces.
Go deeper
Related to this question
About these practice questions
One of 930 original KCNA practice questions on Courseiva, each with a full explanation and wrong-answer analysis — not exam dumps or protected exam content. Learn why practice questions differ from exam dumps →
JA
Written by Johnson Ajibi, MSc IT Security
Senior Network & Security Engineer · founder of Courseiva
This KCNA practice question is part of Courseiva's free CNCF certification practice question bank. Courseiva provides original exam-style practice questions with explanations, topic-based practice, mock exams, readiness tracking, and study analytics to help learners prepare for the KCNA exam.